Executive brief
Stigmem-node is a component used for managing distributed data federation. A flaw in how the system validates security tokens between different nodes can cause valid authentication attempts to be incorrectly rejected as expired. This can lead to service disruptions and prevent authorized systems from communicating with each other, impacting the overall reliability of the network.
Technical details
The vulnerability stems from a mismatch in federation peer-token timestamp handling within stigmem-node. Specifically, the validation logic may incorrectly interpret valid timestamps as expired due to inconsistent time-unit handling (e.g., seconds vs. milliseconds) during the authentication path. An attacker with low privileges could potentially trigger this condition over the network to disrupt federation flows. The issue is classified under CWE-345 (Insufficient Verification of Data Authenticity) and has been addressed in version 0.9.0a2 by implementing a canonical millisecond-based validation path.
Affected products
- eidetic-labs stigmem-node < 0.9.0a2
Timeline
- 2026-05-18: patched: Version 0.9.0a2 released
- 2026-05-19: disclosed
- 2026-05-29: advisory
References
- https://github.com/eidetic-labs/stigmem/security/advisories/GHSA-xh5j-xjfq-qvvx
- https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/CHANGELOG.md
- https://github.com/eidetic-labs/stigmem/blob/v0.9.0a2/SECURITY.md
- https://github.com/eidetic-labs/stigmem/releases/tag/v0.9.0a2
- https://api.github.com/repos/eidetic-labs/stigmem/security-advisories/GHSA-xh5j-xjfq-qvvx